What to check before connecting an AI agent to your CRM

Why AI agent CRM integration needs extra care

Your CRM holds customer contacts, deal values, call notes and the history of every relationship. An agent that can write to it can also damage it quickly: overwrite good data, create duplicates, move deals to the wrong stage or email the wrong people. OWASP calls this risk excessive agency (opens in a new tab): an AI system with more functions, permissions or autonomy than its task needs.

Access control is where many organizations fall short. In IBM's 2026 Cost of a Data Breach research, 92% of organizations that suffered attacks on their AI models had not properly controlled access to them (Cybersecurity Dive (opens in a new tab)). The checklist below covers what to settle before an agent gets write access to your CRM.

Decide which records and fields the agent can use

Start from least privilege (opens in a new tab): NIST defines it as limiting access to the minimum necessary to complete assigned tasks. In a CRM, that means three things:

• A dedicated integration user. The agent works through its own user, not a staff member's account. That keeps its permissions, logs and shutdown separate.
• Object and field permissions. Grant read and write rights separately for each record type and field. Hide fields the task doesn't need, such as payment details, ID numbers or health notes.
• Separate credentials. Store the agent's API keys in a secrets vault, not in prompts or code, and rotate them on a schedule.

The table fits a lead qualification agent such as an AI sales agent. Our guide to AI agent permissions covers other agent types.

Set write rules before the agent writes

• Create and update, but not delete. If a record should go, the agent flags it and a person decides.
• Duplicate checks. Before it creates a contact or company, the agent searches by email, phone and web domain. Keep the CRM's own duplicate rules active as a second check.
• Validation. Required fields, allowed picklist values and phone and email formats apply to the integration user too. Don't exempt it.
• Field ownership. Decide which fields the agent owns. It should not overwrite a value a salesperson entered by hand.
• A change tag. Mark every record the agent creates or edits, so reports and rollbacks can find its work.

Check data quality before the pilot

An agent acts on what the CRM says. If contacts are duplicated, stages mean different things to different teams and owner fields are empty, the agent repeats those errors faster than a person would. Data is a common obstacle: in Anthropic's 2026 State of AI Agents report (opens in a new tab), 42% of technical leaders named data access and quality.

Before the pilot, review duplicates, empty required fields, stage definitions and field owners. Fix the worst problems, or leave the affected records out of the agent's scope.

Protect personal data and consent fields

• Minimization. The agent reads only the fields its task needs. GDPR Article 5 (opens in a new tab) says personal data must be limited to what is necessary for the purpose and kept accurate.
• Consent and opt-out fields. The agent checks do-not-contact, unsubscribe and consent fields before any outreach, and it can read them but not change them. Under GDPR Article 21(3), people can object to direct marketing. In the United States, the FTC's CAN-SPAM guide (opens in a new tab) says email opt-out requests must be honored within 10 business days.
• Where the data goes. Confirm which AI service processes CRM data, in which region and under which terms. Use enterprise terms that exclude your data from model training, with a data processing agreement (DPA) where the law requires one.

Require approval for risky actions

Some actions are hard to undo or affect many records or real people. Put them behind a person's approval:

• Mass updates above a record count you set.
• Deal stage changes, especially to won or lost, which affect forecasts and commissions.
• Outbound emails and messages to customers, at least until a quality sample shows the drafts are reliable.
• Changes to owner, consent or billing fields, and merges of records.

Each approval request should show what will change, why the agent proposes it and which source it used. Our article on human-in-the-loop approvals covers how to design these steps.

Treat CRM notes and emails as untrusted input

Prompt injection means tricking an AI with hidden instructions. In a CRM, those instructions don't need a chat window. They can sit in a web form submission, an inbound email the agent summarizes or a note pasted from a document. OWASP calls this indirect prompt injection (opens in a new tab): input from external sources that changes the model's behavior.

The UK's National Cyber Security Centre warns (opens in a new tab) that prompt injection may never be totally mitigated, so the goal is to limit what an injected instruction can do:

• Enforce permissions and approvals in the integration code, so the model's judgment is not the only barrier.
• Block the agent from sending CRM data to addresses or links it finds in the content it reads.
• Add injection attempts to your test cases, in notes, form fields and email bodies.

Test in a sandbox with synthetic data

Run the first tests in a sandbox copy of the CRM with synthetic records, not with live customer data. Cover the hard cases: duplicates, missing fields, conflicting updates, contacts who opted out, records in other languages and notes with hidden instructions. Run the same tests again after every change to instructions, tools or permissions. Our article on testing with synthetic data covers the method in more detail.

Plan for rate limits, monitoring and rollback

• API quotas. Most CRMs limit API calls per day or per minute. An agent stuck in a retry loop can use up the allowance and stop other integrations, such as billing or marketing syncs. Give the agent its own limit below the CRM quota and alert on unusual volume.
• Audit logs. Keep field history on. The agent's own log should record the input, the chosen action, the result and the approver, in a place the agent cannot edit.
• Monitoring. Track writes per hour, new duplicates, validation errors and rejected approvals, and alert on sudden changes.
• Rollback. Practice restoring a batch of tagged records in the sandbox, and keep one switch that turns off the agent's write access without touching other integrations.

In our pilots, this checklist is part of planning. We map the records, fields and actions with your team, build the controls into the integration and attack-test the agent with injected CRM content before launch. It is one of the steps that decides whether an AI pilot goes live.